Re: auxprop pwcheck with sasl ldapdb and openldap backend not working
"Patrick Pfeifer via SASL" <[email protected]> Fri, 5 Nov 2021 14:36:54 +0100
| Newsgroups | gmane.comp.security.cyrus.sasl |
|---|---|
| Message-ID | <[email protected]> |
I am just wondering _how_ this message can even appear in the log, given
that ...
➜ cyrus-sasl git:(master) git status
On branch master
Your branch is behind 'origin/master' by 182 commits, and can be
fast-forwarded.
(use "git pull" to update your local branch)
nothing to commit, working tree clean
➜ cyrus-sasl git:(master) git describe HEAD
cyrus-sasl-2.1.27
➜ cyrus-sasl git:(master) grep -B2 auxprop-hashed lib/checkpw.c
struct sasl_verify_password_s _sasl_verify_password[] = {
{ "auxprop", &auxprop_verify_password },
{ "auxprop-hashed", &auxprop_verify_password_hashed },
➜ cyrus-sasl git:(master) grep -B30 "unknown password verifier"
lib/server.c
if (_sasl_getcallback(conn, SASL_CB_GETOPT, (sasl_callback_ft
*)&getopt, &context)
== SASL_OK) {
getopt(context, NULL, "pwcheck_method", &mlist, NULL);
}
if(!mlist) mlist = DEFAULT_CHECKPASS_MECH;
result = SASL_NOMECH;
mech = mlist;
while (*mech && result != SASL_OK) {
for (v = _sasl_verify_password; v->name; v++) {
if(is_mech(mech, v->name)) {
result = v->verify(conn, user, pass, service,
s_conn->user_realm);
break;
}
}
if (result != SASL_OK) {
/* skip to next mech in list */
while (*mech && !isspace((int) *mech)) mech++;
while (*mech && isspace((int) *mech)) mech++;
}
else if (!is_mech(mech, "auxprop") && s_conn->sparams->transition) {
s_conn->sparams->transition(conn, pass, passlen);
}
}
if (result == SASL_NOMECH) {
/* no mechanism available ?!? */
_sasl_log(conn, SASL_LOG_ERR, "unknown password verifier(s) %s",
mlist);
-------------
So "mlist" holds "auxprop-hashed", as doesthe second name in
"_sasl_verify_password" ... but that means that the result _should_ be
"_sasl_verify_password + 1", then ... shouldn't it ???
Or is that - maybe - a known bug???
-------
On 2021-11-5 14:16, Patrick Pfeifer via SASL wrote:
> Btw. when I am trying to use "PLAIN" mechanism, I get a slightly
> different error message.... not sure why, as imapd.conf includes
>
> allowplaintext: yes
>
> $ /usr/lib/cyrus/bin/imtest -s -m plain -a patrick -w patrick nexus
> verify error:num=18:self signed certificate
> TLS connection established: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384
> (256/256 bits)
> S: * OK [CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE AUTH=DIGEST-MD5
> AUTH=NTLM AUTH=CRAM-MD5 AUTH=PLAIN AUTH=LOGIN SASL-IR] nexus Cyrus
> IMAP 3.0.13-Debian-3.0.13-5 server ready
> C: A01 AUTHENTICATE PLAIN AHBhdHJpY2sAcGF0cmljaw==
> S: A01 NO no mechanism available
>
> Nov 05 13:12:26 nexus imtest[12065]: ldapdb
> Nov 05 13:12:26 nexus imtest[12065]: _sasl_plugin_load failed on
> sasl_canonuser_init
> Nov 05 13:12:26 nexus cyrus/imaps2[12063]: starttls: TLSv1.3 with
> cipher TLS_AES_256_GCM_SHA384 (256/256 bits new) no authentication
> Nov 05 13:12:26 nexus cyrus/imaps2[12063]: SASL unknown password
> verifier(s) auxprop-hashed
> Nov 05 13:12:26 nexus cyrus/imaps2[12063]: SASL Password verification
> failed
> Nov 05 13:12:26 nexus cyrus/imaps2[12063]: badlogin: nexus
> [fec0::5054:ff:fe12:3456] PLAIN [SASL(-4): no mechanism available:
> Password verification failed]
>
>
> On 2021-11-4 06:46, Дилян Палаузов wrote:
>> Hello Patrick,
>>
>> I propose you make first a working setup with sasldb-backend. This is
>> a local database with username@domain:password. Once it works, your
>> system is set up correctly and only the authentication need to be
>> tweaked.
>>
>> DIGEST-MD5 requires that the server stores the password in plain text.
>> It does work with sasldb, but e.g. with Kerberos it does not work. You
>> have to tell the server explicitly not to advertise DIGEST-MD5 in such
>> cases.
>>
>> Greetings
>> Дилян
>>
>> On Wed, 2021-11-03 at 18:22 -0400, patrick via SASL wrote:
>>> Hallo all
>>>
>>> I am trying to set up cyrus-imap in order to - ultimately - use it as
>>> a caldav/carddav server on a private server.
>>>
>>> I have an openldap instance running in a standard configuration and
>>> would like to use the "auxprop-hashed" pwcheck method along with the
>>> "ldapdb" sasl module.
>>>
>>> This seems not to be as simple as it sounds. Most probably, I am
>>> doing something wrong.
>>>
>>> Is there any chance, somebody could have a look and suggest fixes or
>>> - actually even preferred - point me to a working example of such a
>>> configuration?
>>>
>>> I have search near and far and read hundreads of documentation and
>>> source files, but I fail to make sense of those log lines:
>>>
>>> badlogin: nexus [fec0::5054:ff:fe12:3456] DIGEST-MD5 [SASL(-4): no
>>> mechanism available: unable to canonify user and get auxprops]
>>>
>>> and (or)
>>>
>>> badlogin: nexus [fec0::5054:ff:fe12:3456] PLAIN [SASL(-4): no
>>> mechanism available: Password verification failed]
>>>
>>>
>>> I do not understand, how, why and by which process they are exactly
>>> logged. And, most importantly, can not figure out, what the
>>> underlying problem is, actually? :-) I have tried many tweaks to the
>>> config. Plain password, "auxprop" instead of "auxprop-hashed"
>>> pwcheck, and more, all to no avail.
>>>
>>> This is an up-to-date internet-connected ubuntu-20.04-minimal-
>>> cloudimg-amd64.img currently running in a quemu-vm on MacOS 11.6
>>> (BigSur, 2nd-latest).
>>>
>>> Any help is much appreciated.
>>>
>>> Patrick
>>>
>>> So far, I have:
>>> ubuntu@nexus:~$ egrep -v '^\s*(#|$)' /etc/cyrus.conf
>>> START {
>>> recover cmd="/usr/sbin/cyrus ctl_cyrusdb -r"
>>> delprune cmd="/usr/sbin/cyrus expire -E 3"
>>> tlsprune cmd="/usr/sbin/cyrus tls_prune"
>>> }
>>> SERVICES {
>>> imaps cmd="imapd -s -U 30" listen="nexus:imaps"
>>> prefork=0 maxchild=100
>>> imaplocal cmd="imapd -C /etc/imapd-local.conf -U 30"
>>> listen="localhost:imap" prefork=0 maxchild=100
>>> https cmd="httpd -s -U 30" listen="8443" prefork=0
>>> maxchild=100
>>> lmtpunix cmd="lmtpd" listen="/run/cyrus/socket/lmtp"
>>> prefork=0 maxchild=20
>>> sieve cmd="timsieved" listen="localhost:sieve"
>>> prefork=0 maxchild=100
>>> notify cmd="notifyd"
>>> listen="/run/cyrus/socket/notify" proto="udp" prefork=1
>>> }
>>> EVENTS {
>>> checkpoint cmd="/usr/sbin/cyrus ctl_cyrusdb -c"
>>> period=30
>>> delprune cmd="/usr/sbin/cyrus expire -E 3" at=0401
>>> tlsprune cmd="/usr/sbin/cyrus tls_prune" at=0401
>>> deleteprune cmd="/usr/sbin/cyrus expire -E 4 -D 28"
>>> at=0430
>>> expungeprune cmd="/usr/sbin/cyrus expire -E 4 -X 28"
>>> at=0445
>>> }
>>>
>>> ubuntu@nexus:~$ egrep -v '^\s*(#|$)' /etc/imapd.conf
>>> configdirectory: /var/lib/cyrus
>>> proc_path: /run/cyrus/proc
>>> mboxname_lockpath: /run/cyrus/lock
>>> defaultpartition: default
>>> partition-default: /var/spool/cyrus/mail
>>> partition-news: /var/spool/cyrus/news
>>> newsspool: /var/spool/news
>>> altnamespace: no
>>> unixhierarchysep: no
>>> lmtp_downcase_rcpt: yes
>>> allowanonymouslogin: no
>>> popminpoll: 1
>>> autocreate_quota: 0
>>> umask: 077
>>> sieveusehomedir: false
>>> sievedir: /var/spool/sieve
>>> httpmodules: caldav carddav
>>> hashimapspool: true
>>> allowplaintext: yes
>>> sasl_pwcheck_method: auxprop-hashed
>>> sasl_auxprop_plugin: ldapdb
>>> @include: /etc/imapd-ldap.conf
>>> sasl_auto_transition: no
>>> tls_server_cert: /etc/ssl/certs/ssl-cert-snakeoil.pem
>>> tls_server_key: /etc/ssl/private/ssl-cert-snakeoil.key
>>> tls_client_ca_dir: /etc/ssl/certs
>>> tls_session_timeout: 1440
>>> lmtpsocket: /run/cyrus/socket/lmtp
>>> idlesocket: /run/cyrus/socket/idle
>>> notifysocket: /run/cyrus/socket/notify
>>> syslog_prefix: cyrus
>>>
>>> ubuntu@nexus:~$ egrep -v '^\s*(#|$)' /etc/imapd-ldap.conf
>>> ldap_base: ou=people,dc=patrickpfeifer,dc=net
>>> ldap_bind_dn: cn=admin,dc=patrickpfeifer,dc=net
>>> ldap_filter: (mail=%u)
>>> ldap_password: xxxx
>>> ldap_scope: one
>>> ldap_uri: ldapi:///
>>> ldap_version: 3
>>>
>>> And:
>>> $ ldapsearch -H ldapi:/// -D cn=admin,dc=patrickpfeifer,dc=net -w
>>> xxxx -b 'ou=people,dc=patrickpfeifer,dc=net'
>>> '([email protected])'
>>> # extended LDIF
>>> #
>>> # LDAPv3
>>> # base <ou=people,dc=patrickpfeifer,dc=net> with scope subtree
>>> # filter: ([email protected])
>>> # requesting: ALL
>>> #
>>> # patrick, people, patrickpfeifer.net
>>> dn: uid=patrick,ou=people,dc=patrickpfeifer,dc=net
>>> cn: Patrick Pfeifer
>>> objectClass: inetOrgPerson
>>> objectClass: top
>>> objectClass: person
>>> uid: patrick
>>> mail: [email protected]
>>> sn: Pfeifer
>>> userPassword:: e1NTSXXXXXXXXXXXXXXXc9PQ=
>>> # search result
>>> search: 2
>>> result: 0 Success
>>>
>>> # numResponses: 2
>>> # numEntries: 1
>>>
>>>
>>> However:
>>> $ /usr/lib/cyrus/bin/imtest -s -u [email protected] -w xxxxx
>>> nexus
>>> verify error:num=18:self signed certificate
>>> TLS connection established: TLSv1.3 with cipher
>>> TLS_AES_256_GCM_SHA384 (256/256 bits)
>>> S: * OK [CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE AUTH=DIGEST-MD5
>>> AUTH=NTLM AUTH=CRAM-MD5 AUTH=PLAIN AUTH=LOGIN SASL-IR] nexus Cyrus
>>> IMAP 3.0.13-Debian-3.0.13-5 server ready
>>> C: A01 AUTHENTICATE DIGEST-MD5
>>> S: +
>>> bm9uY2U9IjQ0M3Y3d2R4d0dTNlV1bzFTcFpSTk9JcjFFdHNGL0VkcnU1Q0QzR09PMXc9I
>>> ixyZWFsbT0ibmV4dXMiLHFvcD0iYXV0aCIsbWF4YnVmPTQwOTYsY2hhcnNldD11dGYtOC
>>> xhbGdvcml0aG09bWQ1LXNlc3M=
>>> C:
>>> dXNlcm5hbWU9InVidW50dSIscmVhbG09Im5leHVzIixhdXRoemlkPSJwYXRyaWNrQHBhd
>>> HJpY2twZmVpZmVyLm5ldCIsbm9uY2U9IjQ0M3Y3d2R4d0dTNlV1bzFTcFpSTk9JcjFFdH
>>> NGL0VkcnU1Q0QzR09PMXc9Iixjbm9uY2U9IlM2Yzh4WXJUZXFtcXB3dHYrWGJ2aGk3cTV
>>> HM1dKby8xUWJlSkZZbGM5K289IixuYz0wMDAwMDAwMSxxb3A9YXV0aCxtYXhidWY9MTAy
>>> NCxkaWdlc3QtdXJpPSJpbWFwL25leHVzIixyZXNwb25zZT1iZjBmNjVkYmFiMWZhNjg3M
>>> mRjYjBhNDk0MmJhYzA0OA==
>>> S: A01 NO no mechanism available
>>> Authentication failed. generic failure
>>> Security strength factor: 256
>>> ^CC: Q01 LOGOUT
>>> Connection closed.
>>>
>>> And:
>>> ubuntu@nexus:~$ journalctl -f
>>> -- Logs begin at Mon 2020-12-28 21:20:09 UTC. --
>>>
>>> ...
>>>
>>> Nov 03 21:55:08 nexus sudo[9147]: ubuntu : TTY=pts/0 ;
>>> PWD=/home/ubuntu ; USER=root ; COMMAND=/usr/sbin/service cyrus-imapd
>>> start
>>> Nov 03 21:55:08 nexus sudo[9147]: pam_unix(sudo:session): session
>>> opened for user root by ubuntu(uid=0)
>>> Nov 03 21:55:09 nexus systemd[1]: Started Cyrus IMAP/POP3 daemons.
>>> Nov 03 21:55:09 nexus sudo[9147]: pam_unix(sudo:session): session
>>> closed for user root
>>> Nov 03 21:55:09 nexus cyrus/ctl_cyrusdb[9157]: skiplist: clean
>>> shutdown file missing, updating recovery stamp
>>> Nov 03 21:55:09 nexus cyrus/ctl_cyrusdb[9157]: recovering cyrus
>>> databases
>>> Nov 03 21:55:09 nexus cyrus/ctl_cyrusdb[9157]: done recovering cyrus
>>> databases
>>> Nov 03 21:55:09 nexus cyrus/cyr_expire[9160]: ldapdb
>>> Nov 03 21:55:09 nexus cyrus/cyr_expire[9160]: Expired 0 and expunged
>>> 0 out of 0 messages from 2 mailboxes
>>> Nov 03 21:55:09 nexus cyrus/cyr_expire[9160]: duplicate_prune:
>>> pruning back 3.00 days
>>> Nov 03 21:55:09 nexus cyrus/cyr_expire[9160]: duplicate_prune: purged
>>> 0 out of 0 entries
>>> Nov 03 21:55:09 nexus cyrus/tls_prune[9163]: tls_prune: purged 0 out
>>> of 38 entries
>>> Nov 03 21:55:09 nexus cyrus/master[9156]: unable to bind to
>>> imaps/ipv6 socket: Invalid argument
>>> Nov 03 21:55:09 nexus cyrus/ctl_cyrusdb[9166]: checkpointing cyrus
>>> databases
>>> Nov 03 21:55:09 nexus cyrus/ctl_cyrusdb[9166]: done checkpointing
>>> cyrus databases
>>>
>>> Nov 03 21:55:14 nexus imtest[9170]: ldapdb
>>> Nov 03 21:55:14 nexus imtest[9170]: _sasl_plugin_load failed on
>>> sasl_canonuser_init
>>> Nov 03 21:55:14 nexus cyrus/imaps[9171]: ldapdb
>>> Nov 03 21:55:14 nexus cyrus/imaps[9171]: auxpropfunc error invalid
>>> parameter supplied
>>> Nov 03 21:55:14 nexus cyrus/imaps[9171]: ldapdb
>>> Nov 03 21:55:14 nexus cyrus/imaps[9171]: inittls: Loading hard-coded
>>> DH parameters
>>> Nov 03 21:55:14 nexus cyrus/imaps[9171]: TLS server engine: No client
>>> CA certs specified. Client side certs may not work
>>> Nov 03 21:55:14 nexus cyrus/imaps[9171]: starttls: TLSv1.3 with
>>> cipher TLS_AES_256_GCM_SHA384 (256/256 bits new) no authentication
>>> Nov 03 21:55:14 nexus imtest[9170]: DIGEST-MD5 client step 2
>>> Nov 03 21:55:14 nexus imtest[9170]: DIGEST-MD5
>>> parse_server_challenge()
>>> Nov 03 21:55:14 nexus imtest[9170]: DIGEST-MD5 ask_user_info()
>>> Nov 03 21:55:14 nexus imtest[9170]: DIGEST-MD5 client step 2
>>> Nov 03 21:55:14 nexus imtest[9170]: DIGEST-MD5 ask_user_info()
>>> Nov 03 21:55:14 nexus imtest[9170]: DIGEST-MD5 make_client_response()
>>> Nov 03 21:55:14 nexus cyrus/imaps[9171]: SASL unable to canonify user
>>> and get auxprops
>>> Nov 03 21:55:14 nexus cyrus/imaps[9171]: badlogin: nexus
>>> [fec0::5054:ff:fe12:3456] DIGEST-MD5 [SASL(-4): no mechanism
>>> available: unable to canonify user and get auxprops]
>>>
>>> If I change the "imtest" command line to use then PLAIN mech, I get:
>>> $ /usr/lib/cyrus/bin/imtest -s -m PLAIN -u [email protected]
>>> -w xxxxx nexus
>>>
>>> Nov 03 22:14:45 nexus imtest[9303]: ldapdb
>>> Nov 03 22:14:45 nexus imtest[9303]: _sasl_plugin_load failed on
>>> sasl_canonuser_init
>>> Nov 03 22:14:45 nexus cyrus/imaps[9304]: ldapdb
>>> Nov 03 22:14:45 nexus cyrus/imaps[9304]: auxpropfunc error invalid
>>> parameter supplied
>>> Nov 03 22:14:45 nexus cyrus/imaps[9304]: ldapdb
>>> Nov 03 22:14:45 nexus cyrus/imaps[9304]: inittls: Loading hard-coded
>>> DH parameters
>>> Nov 03 22:14:45 nexus cyrus/imaps[9304]: TLS server engine: No client
>>> CA certs specified. Client side certs may not work
>>> Nov 03 22:14:45 nexus cyrus/imaps[9304]: starttls: TLSv1.3 with
>>> cipher TLS_AES_256_GCM_SHA384 (256/256 bits new) no authentication
>>> Nov 03 22:14:45 nexus cyrus/imaps[9304]: SASL unknown password
>>> verifier(s) auxprop-hashed
>>> Nov 03 22:14:45 nexus cyrus/imaps[9304]: SASL Password verification
>>> failed
>>> Nov 03 22:14:45 nexus cyrus/imaps[9304]: badlogin: nexus
>>> [fec0::5054:ff:fe12:3456] PLAIN [SASL(-4): no mechanism available:
>>> Password verification failed]
>>>
>>>
>>>
>>> More Info:
>>> ubuntu@nexus:~$ lsb_release -a
>>> No LSB modules are available.
>>> Distributor ID: Ubuntu
>>> Description: Ubuntu 20.04.3 LTS
>>> Release: 20.04
>>> Codename: focal
>>>
>>> ubuntu@nexus:~$ dpkg -l | grep cyru\\\|sasl
>>> ii cyrus-admin 3.0.13-5
>>> ii cyrus-caldav 3.0.13-5
>>> ii cyrus-clients 3.0.13-5
>>> ii cyrus-common 3.0.13-5
>>> ii cyrus-imapd 3.0.13-5
>>> ii libcyrus-imap-perl:amd64 3.0.13-5
>>> ii libsasl2-2:amd64 2.1.27+dfsg-2
>>> ii libsasl2-modules:amd64 2.1.27+dfsg-2
>>> ii libsasl2-modules-db:amd64 2.1.27+dfsg-2
>>> ii libsasl2-modules-ldap:amd64 2.1.27+dfsg-2
>>> ii sasl2-bin 2.1.27+dfsg-2
>>>
>>>
>>> Cyrus / SASL / seediscussions +participants
>>> +delivery optionsPermalink
>> ------------------------------------------
>> Cyrus: SASL
>> Permalink:
>> https://cyrus.topicbox.com/groups/sasl/T2c60ca246b64197b-M10276cceecc5033d0cbff41e
>> Delivery options: https://cyrus.topicbox.com/groups/sasl/subscription
------------------------------------------
Cyrus: SASL
Permalink: https://cyrus.topicbox.com/groups/sasl/T2c60ca246b64197b-Mef43c0b132e13fa8276dd59e
Delivery options: https://cyrus.topicbox.com/groups/sasl/subscription